NexShield
NexShield is a malicious Chrome/Edge browser extension used in a KongTuke-attributed campaign (observed by Huntress in Jan 2026) that impersonates the legitimate uBlock Origin Lite ad blocker (near-clone of Raymond Hill’s uBOL codebase) and is distributed via malvertising that leads victims to an official Chrome Web Store listing (extension ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi; developer email: alaynna6899@gmail.com). After installation, it delays execution (Chrome Alarms API; ~60-minute initial delay, then recurring) and performs telemetry/C2 beacons (UUID-based install/update/uninstall tracking) to attacker infrastructure including a typosquatted domain nexsnield[.]com.
Its core malicious behavior is an intentional self-DoS of the browser by creating massive numbers of chrome.runtime port connections in a tight loop, causing severe slowdown/unresponsiveness and crashes. This forced-crash behavior is used to enable a ClickFix-style social-engineering flow dubbed “CrashFix”: after restart, the extension displays a fake “browser stopped abnormally”/“Security Warning” prompt that instructs the user to open Windows Run (Win+R) and paste/execute clipboard contents, while NexShield silently places a malicious PowerShell command onto the clipboard. The CrashFix UI includes anti-analysis/anti-inspection measures (blocking DevTools shortcuts such as F12/Ctrl+Shift+I/J/C, disabling right-click, and preventing text selection/dragging).
Downstream execution (triggered by the user pasting/running the clipboard command) abuses the Windows LOLBin finger.exe by copying it from System32 to %TEMP% and renaming it to ct.exe, then using it to retrieve commands from 199.217.98[.]108 and pipe responses for execution (including PowerShell stages). Later stages include extensive anti-analysis and victim profiling (scanning for 50+ analysis/security tools and VM artifacts; checking domain-joined vs WORKGROUP) and selective payloading. Domain-joined hosts are reported to receive a “VIP” payload delivered via Dropbox: a portable Python environment (WinPython) that runs a Python RAT named ModeloRAT (previously undocumented in the report), which uses RC4-encrypted C2, persists via HKCU\Software\Microsoft\Windows\CurrentVersion\Run (value name “MonitoringService”), and beacons over HTTP/80 to 170.168.103[.]208 and 158.247.252[.]178. Non-domain hosts are described as following a different, more obfuscated chain (including DGA-driven behavior, AMSI bypasses, and a .NET “GateKeeper” loader), and in at least one analyzed branch the actor returned a decoy response (“TEST PAYLOAD!!!!”), consistent with staged rollout or sandbox evasion.
Notable IOCs explicitly mentioned include: Chrome Web Store path /detail/nexshield–advanced-web/cpcdkmjddocikjdkbbeiaafnpdbdafmi; extension ID cpcdkmjddocikjdkbbeiaafnpdbdafmi; developer email alaynna6899@gmail.com; domain nexsnield[.]com; IP 199.217.98[.]108 (including POST to /n with markers ABCD111/BCDA222); Dropbox delivery URL https://www.dropbox.com/scl/fi/6gscgf35byvflw4y6x4i0/b1.zip?rlkey=bk2hvxvw53ggzhbjiftppej50&st=yyxnfu71&dl=1; ModeloRAT C2 IPs 170.168.103[.]208 and 158.247.252[.]178.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...a malicious browser extension called NexShield that impersonates the legitimate uBlock Origin Lite ad blocker..."
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique“Note the typosquatting: the BASE_URL uses nexsnield.com (with an “n”), while the extension name uses nexshield (with an “h”).”
Initial Access
2 techniques“...searching for an ad blocker and getting steered via a malicious ad to NexShield...”
“a malicious browser extension called NexShield that impersonates the legitimate uBlock Origin Lite ad blocker… almost entirely a clone of uBlock Origin Lite”
Execution
3 techniques“To evade detection… uses Chrome's Alarms API to delay execution by 60 minutes… then fires every 10 minutes after the initial trigger.”
“instructed to manually ‘fix’… opening the Windows Run dialog… pasting from their clipboard… The malicious extension silently copies a PowerShell command to the clipboard”
“instructed to… open the Windows Run dialog… pasting from their clipboard… The malicious extension silently copies a PowerShell command to the clipboard… When the user follows these steps, they unknowingly execute the malicious command.”
Persistence
2 techniques“To evade detection… uses Chrome's Alarms API to delay execution by 60 minutes… then fires every 10 minutes after the initial trigger.”
“...getting steered via a malicious ad to NexShield, a Chrome Web Store app masquerading as the legitimate uBlock Origin Lite app.”
Privilege Escalation
1 techniqueStealth
3 techniques“multiple layers of Base64 encoding and XOR… C2 IP addresses built character-by-character… junk code padding… TWO layers of string encryption… AES-256-CBC… then XOR”
“NexShield… impersonates… uBlock Origin Lite… falsely attributes the code to Raymond Hill… references a non-existent GitHub repository.”
Discovery
1 techniqueCollection
1 technique“The malicious extension silently copies a PowerShell command to the clipboard, disguised as a legitimate repair command.”
Command and Control
1 technique“When the extension is first installed, it sends a beacon… to the attacker's server… On extension updates, additional telemetry is sent… The extension sets an uninstall URL to track when users remove it.”
Impact
2 techniques“The core malicious payload is a denial-of-service attack against the victim's own browser… iterate 1 billion times… infinite loop… exhausts system resources… eventual crashes.”
“...intentionally crashing the browser, flooding the system with endless connection requests and quickly consuming all available memory and processing power.”
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Fake ad-blocking Chrome/Edge extension used in a malvertising campaign; intentionally crashes the browser and presents a fraudulent 'fix' flow to lead victims into executing malicious commands, ultimately delivering additional payloads (e.g., ModeloRAT).
A malicious Chrome browser extension used to establish an enterprise foothold and escalate into remote access/backdoor capability.
Malicious browser extension used in KongTuke operations; impersonates uBlock Origin Lite and is part of a chain that includes user-baiting to run commands and deployment of a RAT on domain-joined hosts.
Malicious Chrome extension that impersonates uBlock Origin Lite, beacons install/update/uninstall telemetry (UUID) to attacker infrastructure, delays execution, then triggers browser resource-exhaustion (self-DoS) and displays a fake security warning (CrashFix) to socially engineer users into executing a clipboarded PowerShell command.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.